release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

permissions:
  contents: read

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write # needed to create the GitHub Release and upload its assets via `gh`
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Verify tag is on main
        run: |
          set -eu
          git fetch origin main --quiet
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "refusing to release: $GITHUB_SHA is not an ancestor of origin/main" >&2
            exit 1
          fi

      - name: POSIX sh syntax check
        run: sh -n install.sh

      - name: Install dash
        run: sudo apt-get update && sudo apt-get install -y dash

      - name: dash syntax check
        run: dash -n install.sh

      - name: Install ShellCheck
        run: sudo apt-get install -y shellcheck

      - name: ShellCheck
        run: shellcheck --shell=sh --severity=style install.sh

      - name: Install PSScriptAnalyzer
        shell: pwsh
        run: Install-Module -Name PSScriptAnalyzer -Scope CurrentUser -Force -SkipPublisherCheck

      - name: PSScriptAnalyzer
        shell: pwsh
        run: Invoke-ScriptAnalyzer -Path install.ps1 -Settings PSGallery -EnableExit

      - name: PowerShell AST parse check
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $tokens = $null
          $errors = $null
          [void][System.Management.Automation.Language.Parser]::ParseFile("install.ps1", [ref]$tokens, [ref]$errors)
          if ($errors.Count -gt 0) {
            foreach ($e in $errors) { Write-Error $e }
            throw "AST parse errors found in install.ps1"
          }

      - name: Generate SHA256SUMS
        run: sha256sum install.sh install.ps1 > SHA256SUMS

      - name: Prepare release notes
        env:
          TAG: ${{ github.ref_name }}
          SOURCE_REPO: ${{ github.repository }}
        run: |
          set -eu
          {
            printf 'Cloudsmith CLI installer scripts %s\n\n' "$TAG"
            printf 'Source repository: %s\n' "$SOURCE_REPO"
            printf 'Source commit: %s\n\n' "$GITHUB_SHA"
            printf 'Verify SHA256SUMS against install.sh and install.ps1 before use.\n'
            printf 'Releases are immutable: assets for this tag do not change after publication.\n'
          } > RELEASE_NOTES.md

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          gh release create "$TAG" install.sh install.ps1 SHA256SUMS \
            --verify-tag \
            --notes-file RELEASE_NOTES.md

  vendor:
    name: Vendor (${{ matrix.repo }})
    needs: release
    if: ${{ vars.ENABLE_VENDORING == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      # Only needs to read this repo; PRs against integration repos are
      # authenticated separately via VENDORING_GITHUB_TOKEN.
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - repo: cloudsmith-io/cloudsmith-cli-action
            integration: github-action
          - repo: cloudsmith-io/orb
            integration: circleci-orb
          - repo: cloudsmith-io/cloudsmith-ado-integration
            integration: azure-devops
    steps:
      - name: Checkout installer repo
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Clone target integration repo
        env:
          VENDOR_TOKEN: ${{ secrets.VENDORING_GITHUB_TOKEN }}
          TARGET_REPO: ${{ matrix.repo }}
        run: |
          set -eu
          git clone --depth 1 "https://x-access-token:${VENDOR_TOKEN}@github.com/${TARGET_REPO}.git" target-repo

      - name: Vendor release assets
        env:
          INTEGRATION: ${{ matrix.integration }}
          TAG: ${{ github.ref_name }}
        run: |
          set -eu
          case "$INTEGRATION" in
            github-action)
              destination="target-repo/installer"
              mkdir -p "$destination"
              cp install.sh install.ps1 "$destination/"
              printf '%s\n' "$TAG" > "$destination/VERSION"
              (
                cd "$destination"
                sha256sum install.sh install.ps1 > SHA256SUMS
              )
              ;;
            circleci-orb)
              destination="target-repo/src/scripts"
              mkdir -p "$destination"
              cp install.sh "$destination/install.sh"
              sha="$(sha256sum install.sh | awk '{print $1}')"
              printf 'version=%s\nsha256=%s\n' "$TAG" "$sha" \
                > "$destination/install.sh.version"
              ;;
            azure-devops)
              destination="target-repo/cloudsmith-task/installer"
              mkdir -p "$destination"
              cp install.sh install.ps1 "$destination/"
              printf '%s\n' "$TAG" > "$destination/VERSION"
              ;;
            *)
              echo "unsupported integration: $INTEGRATION" >&2
              exit 1
              ;;
          esac

      - name: Verify vendored files
        env:
          INTEGRATION: ${{ matrix.integration }}
        run: |
          set -eu
          case "$INTEGRATION" in
            github-action)
              destination="target-repo/installer"
              cmp install.sh "$destination/install.sh"
              cmp install.ps1 "$destination/install.ps1"
              test -s "$destination/VERSION"
              (cd "$destination" && sha256sum -c SHA256SUMS)
              ;;
            circleci-orb)
              destination="target-repo/src/scripts"
              cmp install.sh "$destination/install.sh"
              expected="$(awk -F= '$1 == "sha256" {print $2}' "$destination/install.sh.version")"
              actual="$(sha256sum install.sh | awk '{print $1}')"
              test -n "$(awk -F= '$1 == "version" {print $2}' "$destination/install.sh.version")"
              test "$expected" = "$actual"
              ;;
            azure-devops)
              destination="target-repo/cloudsmith-task/installer"
              cmp install.sh "$destination/install.sh"
              cmp install.ps1 "$destination/install.ps1"
              test -s "$destination/VERSION"
              ;;
            *)
              echo "unsupported integration: $INTEGRATION" >&2
              exit 1
              ;;
          esac

      - name: Commit and open vendoring PR
        env:
          GH_TOKEN: ${{ secrets.VENDORING_GITHUB_TOKEN }}
          TARGET_REPO: ${{ matrix.repo }}
          TAG: ${{ github.ref_name }}
          SOURCE_REPO: ${{ github.repository }}
        run: |
          set -eu
          cd target-repo
          git config user.name "cloudsmith-installer-bot"
          git config user.email "engineering@cloudsmith.io"
          branch="vendor/installer-${TAG}"
          git checkout -b "$branch"
          git add -A
          if git diff --cached --quiet; then
            echo "no changes to vendor; skipping PR"
            exit 0
          fi
          git commit -m "chore: vendor installer scripts ${TAG} from ${SOURCE_REPO}"
          # Fetch first so --force-with-lease has a remote-tracking ref to
          # compare against when a previous run already pushed this branch;
          # the explicit refspec is needed because the clone is single-branch.
          git fetch origin "+refs/heads/$branch:refs/remotes/origin/$branch" 2>/dev/null || true
          git push --force-with-lease origin "$branch"
          if [ -n "$(gh pr list --repo "$TARGET_REPO" --head "$branch" --json number --jq '.[].number')" ]; then
            echo "vendoring PR for $branch already exists; skipping creation"
            exit 0
          fi
          gh pr create \
            --repo "$TARGET_REPO" \
            --title "chore: vendor installer scripts ${TAG}" \
            --body "Vendors install.sh/install.ps1 from ${SOURCE_REPO}@${TAG} (commit ${GITHUB_SHA})."

  publish-cloudsmith:
    name: Publish to Cloudsmith
    needs: release
    if: ${{ vars.CLOUDSMITH_SERVICE_SLUG != '' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # needed for the CLI to exchange the GitHub Actions OIDC token
    env:
      # Consumed automatically by the CLI's GitHub Actions OIDC exchange.
      CLOUDSMITH_ORG: ${{ vars.CLOUDSMITH_NAMESPACE }}
      CLOUDSMITH_SERVICE_SLUG: ${{ vars.CLOUDSMITH_SERVICE_SLUG }}
      CLOUDSMITH_NAMESPACE: ${{ vars.CLOUDSMITH_NAMESPACE }}
      CLOUDSMITH_REPO: ${{ vars.CLOUDSMITH_REPO }}
      TAG: ${{ github.ref_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Install the Cloudsmith CLI using install.sh
        run: |
          set -eu
          output="$(sh ./install.sh --version latest)"
          printf '%s\n' "$output"
          executable="$(printf '%s\n' "$output" | grep '^executable=' | cut -d= -f2-)"
          test -n "$executable"
          echo "CLOUDSMITH_BIN=$executable" >> "$GITHUB_ENV"

      # The scripts are published as cli.sh and cli.ps1, served at
      # https://install.cloudsmith.com/raw/files/cli.<sh|ps1>.
      - name: Stage scripts under their published names
        run: |
          set -eu
          cp install.sh cli.sh
          cp install.ps1 cli.ps1
          sha256sum cli.sh cli.ps1 > SHA256SUMS

      - name: Authenticate via GitHub OIDC
        run: |
          set -eu
          "$CLOUDSMITH_BIN" whoami

      - name: Push install scripts
        run: |
          set -eu
          VERSION="${TAG#v}"
          for file in cli.sh cli.ps1 SHA256SUMS; do
            "$CLOUDSMITH_BIN" push raw \
              "$CLOUDSMITH_NAMESPACE/$CLOUDSMITH_REPO" \
              "$file" \
              --name "$file" \
              --version "$VERSION" \
              --republish
          done

      - name: Verify published files
        run: |
          set -eu
          VERSION="${TAG#v}"
          for file in cli.sh cli.ps1 SHA256SUMS; do
            url="https://dl.cloudsmith.io/public/$CLOUDSMITH_NAMESPACE/$CLOUDSMITH_REPO/raw/versions/$VERSION/$file"
            if ! curl -fsSL "$url" -o "verify-$file"; then
              echo "notice: could not download $url (repository may still be private); skipping verification"
              continue
            fi
            expected="$(sha256sum "$file" | awk '{print $1}')"
            actual="$(sha256sum "verify-$file" | awk '{print $1}')"
            if [ "$expected" != "$actual" ]; then
              echo "checksum mismatch for $url" >&2
              exit 1
            fi
            echo "verified $url"
          done